CVE-2021-25642

Опубликовано: 25 авг. 2022

Источник: nvd

CVSS3: 8.8

EPSS Низкий

Описание

ZKConfigurationStore which is optionally used by CapacityScheduler of Apache Hadoop YARN deserializes data obtained from ZooKeeper without validation. An attacker having access to ZooKeeper can run arbitrary commands as YARN user by exploiting this. Users should upgrade to Apache Hadoop 2.10.2, 3.2.4, 3.3.4 or later (containing YARN-11126) if ZKConfigurationStore is used.

Ссылки

https://lists.apache.org/thread/g6vf2h4wdgzzdgk91mqozhs58wotq150
Mailing List
Vendor Advisory
https://security.netapp.com/advisory/ntap-20221201-0003/
Third Party Advisory
https://lists.apache.org/thread/g6vf2h4wdgzzdgk91mqozhs58wotq150
Mailing List
Vendor Advisory
https://security.netapp.com/advisory/ntap-20221201-0003/
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:apache:hadoop:*:*:*:*:*:*:*:*

Версия от 2.9.0 (включая) до 2.10.2 (исключая)

cpe:2.3:a:apache:hadoop:*:*:*:*:*:*:*:*

Версия от 3.0.0 (включая) до 3.2.4 (исключая)

cpe:2.3:a:apache:hadoop:*:*:*:*:*:*:*:*

Версия от 3.3.0 (включая) до 3.3.4 (исключая)

EPSS

Процентиль: 84%

0.02074

Низкий

8.8 High

CVSS3

Дефекты

CWE-502

Связанные уязвимости

CVE-2021-25642

CVSS3: 7.5

redhat

больше 3 лет назад

CVE-2021-25642

CVSS3: 8.8

debian

больше 3 лет назад

ZKConfigurationStore which is optionally used by CapacityScheduler of ...

GHSA-rr2m-gffv-mgrj

CVSS3: 8.8

github

больше 3 лет назад

Deserialization of Untrusted Data in Apache Hadoop YARN

EPSS

Процентиль: 84%

0.02074

Низкий

8.8 High

CVSS3

Дефекты

CWE-502